{"id":"ASB-A-392852041","details":"In ethnl_ops_begin of netlink.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-392852041","CVE-2025-21701"],"modified":"2026-05-26T15:46:26.044149249Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/cdd207534a0c4a4f2e4684b90794924a0550e66d"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/2afd0800a730081c941189e3174ed0a30f4c59e7"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2025-09-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"spl":"2025-09-05","fixes":["https://android.googlesource.com/kernel/common/+/cdd207534a0c4a4f2e4684b90794924a0550e66d","https://android.googlesource.com/kernel/common/+/2afd0800a730081c941189e3174ed0a30f4c59e7"],"types":["EoP"],"severity":"High","vanir_signatures":[{"signature_type":"Line","target":{"file":"net/ethtool/netlink.c"},"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/cdd207534a0c4a4f2e4684b90794924a0550e66d","deprecated":false,"id":"ASB-A-392852041-c46d14cb","digest":{"threshold":0.9,"line_hashes":["172231033618138296802010778550905766852","152295685349910418206590432446842144765","87806915282566257460123354657461228025","297562863665192147190683885644416352543"]}},{"signature_type":"Function","signature_version":"v1","digest":{"length":468,"function_hash":"257543006366309202372562986636404430770"},"source":"https://android.googlesource.com/kernel/common/+/2afd0800a730081c941189e3174ed0a30f4c59e7","deprecated":false,"id":"ASB-A-392852041-d39e11ac","target":{"function":"ethnl_ops_begin","file":"net/ethtool/netlink.c"}},{"signature_type":"Line","id":"ASB-A-392852041-e2bd069b","digest":{"threshold":0.9,"line_hashes":["172231033618138296802010778550905766852","152295685349910418206590432446842144765","87806915282566257460123354657461228025","297562863665192147190683885644416352543"]},"source":"https://android.googlesource.com/kernel/common/+/2afd0800a730081c941189e3174ed0a30f4c59e7","deprecated":false,"signature_version":"v1","target":{"file":"net/ethtool/netlink.c"}},{"signature_type":"Function","id":"ASB-A-392852041-e38362a0","digest":{"length":468,"function_hash":"257543006366309202372562986636404430770"},"source":"https://android.googlesource.com/kernel/common/+/cdd207534a0c4a4f2e4684b90794924a0550e66d","deprecated":false,"signature_version":"v1","target":{"function":"ethnl_ops_begin","file":"net/ethtool/netlink.c"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-392852041.json"}}],"schema_version":"1.7.5"}